WordPress Plugin Vulnerabilities

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

Description

The plugin does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.

Proof of Concept

Create a new download on:
https://target-site/wp-admin/post-new.php?post_type=dlm_download

Add the following payload to the "File URL(s); note: only enter multiple URLs in here if you want to use file mirrors" field when creating a new Download:
php://filter/convert.base64-encode/resource=/var/www/vhosts/developerspace.de/httpdocs/blog/wp-config.php

Navigate to the newly created download page.

Affects Plugins

Plugin icon
download-monitor
Fixed in 4.5.98

References

CVE
CVE-2022-2981

Classification

Type
FILE DOWNLOAD
OWASP top 10
A1: Injection
CWE
CWE-552
CVSS
4.5 (medium)

Miscellaneous

Original Researcher
Raad Haddad of Cloudyrion GmbH
Submitter
Raad Haddad of Cloudyrion GmbH
Submitter twitter
raadfhaddad
Verified
Yes
WPVDB ID
30ce32ce-161c-4388-8d22-751350b7b305

Timeline

Publicly Published
2022-09-19 (about 1 years ago)
Added
2022-09-19 (about 1 years ago)
Last Updated
2022-09-19 (about 1 years ago)

Other

Published
Title
Published
2022-12-05
Title
Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
Published
2022-11-22
Title
SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download
Published
2023-06-12
Title
wpForo Forum < 2.1.8 - Subscriber+ Arbitrary File Read, Author+ PHAR Deserialization, and Subscriber+ Server-Side Request Forgery via file_get_contents
Published
2022-01-10
Title
SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download
Published
2022-08-01
Title
Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download